CVE-2026-4600

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 11.1.1

Description Improper verification of cryptographic signatures occurs due to flawed DSA domain-parameter validation in the KJUR.crypto.DSA.setPublic() function and the associated DSA/X509 verification flow in src/dsa-2.0.js. An attacker can forge DSA signatures or X.509 certificates that the X509.verifySignature() function accepts by providing malicious domain parameters, specifically g=1, y=1, and a fixed r=1, which causes the verification equation to be true for any hash.

Recommendations Update jsrsasign to version 11.1.1 or later.